What is the CVSS score of CVE-2026-5711?

CVE-2026-5711 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-5711

EUVD-2026-20783 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Wordfence

GHSA-pxvw-54xc-72wm

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20783

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:25 nvd

MEDIUM 6.4

DescriptionCVE.org

The Post Blocks & Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sliderStyle' block attribute in the Posts Slider block in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Post Blocks & Tools WordPress plugin versions up to 1.3.0 allows authenticated attackers with author-level access to inject arbitrary JavaScript through the 'sliderStyle' block attribute in the Posts Slider block, which executes in the browsers of all users viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping, enabling persistent payload injection that affects any site administrator or editor visiting a compromised post.

Technical ContextAI

The Post Blocks & Tools plugin (CPE: cpe:2.3:a:pubudu-malalasekara:post_blocks_&_tools:*:*:*:*:*:*:*:*) implements a Posts Slider block that accepts user-supplied attributes including 'sliderStyle' without proper sanitization before output. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a stored/persistent XSS variant. The flaw occurs in the view.php rendering logic where block attributes are echoed directly into the DOM without escaping HTML special characters or using WordPress's esc_attr() or esc_html() functions. Since this is a Gutenberg block attribute, the injection occurs during block registration and content rendering, affecting the server-side rendering pipeline rather than client-side JavaScript execution.

RemediationAI

Update the Post Blocks & Tools plugin to version 1.3.1 or later immediately. The patched version is available in the WordPress plugin repository and can be updated via the WordPress admin dashboard (Plugins > Installed Plugins > Post Blocks & Tools > Update) or via WP-CLI (wp plugin update post-blocks-and-tools). Site administrators should review recent posts and pages edited by author-level accounts for suspicious slider blocks with malicious styling attributes. For sites unable to immediately patch, temporarily deactivate the plugin or restrict author-level capabilities until the update is deployed. Refer to the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/aeada6dc-0851-45e8-ada9-ff0427b7f17a?source=cve and the WordPress plugin repository changeset for implementation details.